187737[.]dat[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

187737.dat.dll
Size

771KB
MD5

ac377cea30d0b6227c70ae0ef6871f71
SHA1

1223a42bea918585ed4ea77e6c8ad9b3f151e2a7
SHA256

476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b
SHA512

a485d993902673aeeb0cecf57f1fb3d0b0f5c24d11dc769831be6f2ad48024c5d1fe088629befd75f281154df99721e414fe45a57a376a364af7637ea19d0cd7
SSDEEP

24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8

Score

1^/10

Malware Config

Signatures

Files

187737.dat.dll
.dll windows x86

e62ccf1e5c561da53ca2f798bfd5b608

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___mb_cur_max_func
__setusermatherr
_amsg_exit
_errno
_initterm
_iob
_lock
_stati64
_unlock
abort
atoi
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcmp
memcpy
memmove
localtime
realloc
setlocale
strchr
strcmp
strerror
strftime
strlen
strncmp
vfprintf
time
wcslen
_getpid

netapi32

NetApiBufferFree
NetGetAnyDCName
NetGroupEnum
NetGroupGetInfo
NetUserEnum
NetUserGetGroups
NetUserGetInfo

ole32

CoInitialize
CoUninitialize

shell32

SHGetFolderPathW
SHGetFolderPathW

userenv

GetProfilesDirectoryW
GetProfilesDirectoryW

Exports

Exports

RZ10KABOUTDATAv
RZ13DESKTOPPARSERv
RZ13listToVariantI12KAboutPersonE5QListI8QVariantERKS1_IT_E
RZ13listToVariantI13KAboutLicenseE5QListI8QVariantERKS1_IT_E
RZ17KCOREADDONS_DEBUGv
RZ19staleMatchesManagedRK7QStringRK4QUrl
RZ22enumerateGroupsForUserI19_GROUP_USERS_INFO_0ZN5KUser7Private6createE7KUserIdEUlRKS0_E_EvjRK7QStringT0_
RZ27determineFileSystemTypeImplRK10QByteArray
RZ27qRegisterNormalizedMetaTypeI5QPairI7QStringS1_EEiRK10QByteArrayPT_N9QtPrivate21MetaTypeDefinedHelperIS6_Xaasr12QMetaTypeId2IS6_E7DefinedntsrSB_9IsBuiltInEE11DefinedTypeE
RZ5qHashRK7KUserIdj
RZ5qHashRK8KGroupIdj
RZ8MIGRATORv
RZ9KDIRWATCHv
RZGVZN9QtPrivate14IsMetaTypePairI5QPairI7QStringS2_ELb1EE17registerConverterEiE1f
RZN10KAboutData10addLicenseEN13KAboutLicense10LicenseKeyE
RZN10KAboutData10addLicenseEN13KAboutLicense10LicenseKeyENS0_18VersionRestrictionE
RZN10KAboutData10pluginDataERK7QString
RZN10KAboutData10setLicenseEN13KAboutLicense10LicenseKeyE
RZN10KAboutData10setLicenseEN13KAboutLicense10LicenseKeyENS0_18VersionRestrictionE
RZN10KAboutData10setVersionERK10QByteArray
RZN10KAboutData11setHomepageERK7QString
RZN10KAboutData12setOtherTextERK7QString
RZN10KAboutData13setBugAddressERK10QByteArray
RZN10KAboutData13setTranslatorERK7QStringS2_
RZN10KAboutData14addLicenseTextERK7QString
RZN10KAboutData14setDisplayNameERK7QString
RZN10KAboutData14setLicenseTextERK7QString
RZN10KAboutData14setOcsProviderERK7QString
RZN10KAboutData14setProductNameERK10QByteArray
RZN10KAboutData14setProgramLogoERK8QVariant
RZN10KAboutData15applicationDataEv
RZN10KAboutData16setComponentNameERK7QString
RZN10KAboutData16setupCommandLineEP18QCommandLineParser
RZN10KAboutData16staticMetaObjectE
RZN10KAboutData18addLicenseTextFileERK7QString
RZN10KAboutData18fromPluginMetaDataERK15KPluginMetaData
RZN10KAboutData18processCommandLineEP18QCommandLineParser
RZN10KAboutData18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN10KAboutData18registerPluginDataERKS_
RZN10KAboutData18setApplicationDataERKS_
RZN10KAboutData18setDesktopFileNameERK7QString
RZN10KAboutData18setLicenseTextFileERK7QString
RZN10KAboutData18setProgramIconNameERK7QString
RZN10KAboutData19setCustomAuthorTextERK7QStringS2_
RZN10KAboutData19setShortDescriptionERK7QString
RZN10KAboutData20aboutTranslationTeamEv
RZN10KAboutData21setCopyrightStatementERK7QString
RZN10KAboutData21setOrganizationDomainERK10QByteArray
RZN10KAboutData21unsetCustomAuthorTextEv
RZN10KAboutData22applicationDataPointerEv
RZN10KAboutData7Private16parseTranslatorsERK7QStringS3_
RZN10KAboutData9addAuthorERK7QStringS2_S2_S2_S2_
RZN10KAboutData9addCreditERK7QStringS2_S2_S2_S2_
RZN10KAboutDataC1ERK7QStringS2_S2_
RZN10KAboutDataC1ERK7QStringS2_S2_S2_N13KAboutLicense10LicenseKeyES2_S2_S2_S2_
RZN10KAboutDataC1ERKS_
RZN10KAboutDataC2ERK7QStringS2_S2_
RZN10KAboutDataC2ERK7QStringS2_S2_S2_N13KAboutLicense10LicenseKeyES2_S2_S2_S2_
RZN10KAboutDataC2ERKS_
RZN10KAboutDataD1Ev
RZN10KAboutDataD2Ev
RZN10KAboutDataaSERKS_
RZN10KFileUtils11suggestNameERK4QUrlRK7QString
RZN10KFileUtils17makeSuggestedNameERK7QString
RZN10KOSRelease7PrivateC1E7QString
RZN10KOSReleaseC1ERK7QString
RZN10KOSReleaseC2ERK7QString
RZN10KOSReleaseD1Ev
RZN10KOSReleaseD2Ev
RZN10KUserGroup13allGroupNamesEj
RZN10KUserGroup9allGroupsEj
RZN10KUserGroupC1E8KGroupId
RZN10KUserGroupC1EN5KUser7UIDModeE
RZN10KUserGroupC1EPKc
RZN10KUserGroupC1EPv
RZN10KUserGroupC1ERK7QString
RZN10KUserGroupC1ERKS_
RZN10KUserGroupC2E8KGroupId
RZN10KUserGroupC2EN5KUser7UIDModeE
RZN10KUserGroupC2EPKc
RZN10KUserGroupC2EPv
RZN10KUserGroupC2ERK7QString
RZN10KUserGroupC2ERKS_
RZN10KUserGroupD1Ev
RZN10KUserGroupD2Ev
RZN10KUserGroupaSERKS_
RZN10QByteArrayD1Ev
RZN11KCoreAddons13versionStringEv
RZN11KCoreAddons7versionEv
RZN11KJobPrivate15_k_speedTimeoutEv
RZN11KJobPrivateC1Ev
RZN11KJobPrivateC2Ev
RZN11KJobPrivateD0Ev
RZN11KJobPrivateD1Ev
RZN11KJobPrivateD2Ev
RZN11KTextToHTML13convertToHtmlERK7QStringRK6QFlagsINS_6OptionEEii
RZN12KAboutPerson16staticMetaObjectE
RZN12KAboutPerson18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN12KAboutPerson8fromJSONERK11QJsonObject
RZN12KAboutPersonC1ERK7QStringS2_S2_S2_S2_
RZN12KAboutPersonC1ERK7QStringS2_b
RZN12KAboutPersonC1ERKS_
RZN12KAboutPersonC2ERK7QStringS2_S2_S2_S2_
RZN12KAboutPersonC2ERK7QStringS2_b
RZN12KAboutPersonC2ERKS_
RZN12KAboutPersonD1Ev
RZN12KAboutPersonD2Ev
RZN12KAboutPersonaSERKS_
RZN12KProcessList11processInfoEx
RZN12KProcessList12KProcessInfoC1ERKS0_
RZN12KProcessList12KProcessInfoC1Ev
RZN12KProcessList12KProcessInfoC1ExRK7QStringS3_
RZN12KProcessList12KProcessInfoC1ExRK7QStringS3_S3_
RZN12KProcessList12KProcessInfoC2ERKS0_
RZN12KProcessList12KProcessInfoC2Ev
RZN12KProcessList12KProcessInfoC2ExRK7QStringS3_
RZN12KProcessList12KProcessInfoC2ExRK7QStringS3_S3_
RZN12KProcessList12KProcessInfoD1Ev
RZN12KProcessList12KProcessInfoD2Ev
RZN12KProcessList12KProcessInfoaSERKS0_
RZN12KProcessList15processInfoListEv
RZN12KProcessList19KProcessInfoPrivateC1Ev
RZN12KProcessList19KProcessInfoPrivateC2Ev
RZN12KUrlMimeData11setMetaDataERK4QMapI7QStringS1_EP9QMimeData
RZN12KUrlMimeData13mimeDataTypesEv
RZN12KUrlMimeData16urlsFromMimeDataEPK9QMimeDataNS_13DecodeOptionsEP4QMapI7QStringS5_E
RZN12KUrlMimeData7setUrlsERK5QListI4QUrlES4_P9QMimeData
RZN13KAboutLicense16staticMetaObjectE
RZN13KAboutLicense18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN13KAboutLicense18setLicenseFromPathERK7QString
RZN13KAboutLicense18setLicenseFromTextERK7QString
RZN13KAboutLicense7PrivateC1ENS_10LicenseKeyENS_18VersionRestrictionEPK10KAboutData
RZN13KAboutLicense7PrivateC1ERKS0_
RZN13KAboutLicense7PrivateC2ENS_10LicenseKeyENS_18VersionRestrictionEPK10KAboutData
RZN13KAboutLicense7PrivateC2ERKS0_
RZN13KAboutLicense9byKeywordERK7QString
RZN13KAboutLicenseC1ENS_10LicenseKeyENS_18VersionRestrictionEPK10KAboutData
RZN13KAboutLicenseC1ENS_10LicenseKeyEPK10KAboutData
RZN13KAboutLicenseC1EPK10KAboutData
RZN13KAboutLicenseC1ERKS_
RZN13KAboutLicenseC1Ev
RZN13KAboutLicenseC2ENS_10LicenseKeyENS_18VersionRestrictionEPK10KAboutData
RZN13KAboutLicenseC2ENS_10LicenseKeyEPK10KAboutData
RZN13KAboutLicenseC2EPK10KAboutData
RZN13KAboutLicenseC2ERKS_
RZN13KAboutLicenseC2Ev
RZN13KAboutLicenseD1Ev
RZN13KAboutLicenseD2Ev
RZN13KAboutLicenseaSERKS_
RZN13KAutoSaveFile10staleFilesERK4QUrlRK7QString
RZN13KAutoSaveFile11qt_metacallEN11QMetaObject4CallEiPPv
RZN13KAutoSaveFile11qt_metacastEPKc
RZN13KAutoSaveFile11releaseLockEv
RZN13KAutoSaveFile13allStaleFilesERK7QString
RZN13KAutoSaveFile14setManagedFileERK4QUrl
RZN13KAutoSaveFile16staticMetaObjectE
RZN13KAutoSaveFile18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN13KAutoSaveFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
RZN13KAutoSaveFileC1EP7QObject
RZN13KAutoSaveFileC1ERK4QUrlP7QObject
RZN13KAutoSaveFileC2EP7QObject
RZN13KAutoSaveFileC2ERK4QUrlP7QObject
RZN13KAutoSaveFileD0Ev
RZN13KAutoSaveFileD1Ev
RZN13KAutoSaveFileD2Ev
RZN13KCompositeJob10slotResultEP4KJob
RZN13KCompositeJob11qt_metacallEN11QMetaObject4CallEiPPv
RZN13KCompositeJob11qt_metacastEPKc
RZN13KCompositeJob12clearSubjobsEv
RZN13KCompositeJob12removeSubjobEP4KJob
RZN13KCompositeJob15slotInfoMessageEP4KJobRK7QStringS4_
RZN13KCompositeJob16staticMetaObjectE
RZN13KCompositeJob18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN13KCompositeJob9addSubjobEP4KJob
RZN13KCompositeJobC1EP7QObject
RZN13KCompositeJobC1ER20KCompositeJobPrivateP7QObject
RZN13KCompositeJobC2EP7QObject
RZN13KCompositeJobC2ER20KCompositeJobPrivateP7QObject
RZN13KCompositeJobD0Ev
RZN13KCompositeJobD1Ev
RZN13KCompositeJobD2Ev
RZN13KPluginLoader10findPluginERK7QString
RZN13KPluginLoader11findPluginsERK7QStringSt8functionIFbRK15KPluginMetaDataEE
RZN13KPluginLoader11qt_metacallEN11QMetaObject4CallEiPPv
RZN13KPluginLoader11qt_metacastEPKc
RZN13KPluginLoader12setLoadHintsE6QFlagsIN8QLibrary8LoadHintEE
RZN13KPluginLoader13forEachPluginERK7QStringSt8functionIFvS2_EE
RZN13KPluginLoader13pluginVersionEv
RZN13KPluginLoader15findPluginsByIdERK7QStringS2_
RZN13KPluginLoader16staticMetaObjectE
RZN13KPluginLoader18instantiatePluginsERK7QStringSt8functionIFbRK15KPluginMetaDataEEP7QObject
RZN13KPluginLoader18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN13KPluginLoader4loadEv
RZN13KPluginLoader6unloadEv
RZN13KPluginLoader7factoryEv
RZN13KPluginLoader8instanceEv
RZN13KPluginLoaderC1ERK11KPluginNameP7QObject
RZN13KPluginLoaderC1ERK7QStringP7QObject
RZN13KPluginLoaderC2ERK11KPluginNameP7QObject
RZN13KPluginLoaderC2ERK7QStringP7QObject
RZN13KPluginLoaderD0Ev
RZN13KPluginLoaderD1Ev
RZN13KPluginLoaderD2Ev
RZN14KFormatPrivateC1ERK7QLocale
RZN14KFormatPrivateC2ERK7QLocale
RZN14KFormatPrivateD0Ev
RZN14KFormatPrivateD1Ev
RZN14KFormatPrivateD2Ev
RZN14KJobUiDelegate10connectJobEP4KJob
RZN14KJobUiDelegate11qt_metacallEN11QMetaObject4CallEiPPv
RZN14KJobUiDelegate11qt_metacastEPKc
RZN14KJobUiDelegate11slotWarningEP4KJobRK7QStringS4_
RZN14KJobUiDelegate16showErrorMessageEv
RZN14KJobUiDelegate16staticMetaObjectE
RZN14KJobUiDelegate18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN14KJobUiDelegate27setAutoErrorHandlingEnabledEb
RZN14KJobUiDelegate29setAutoWarningHandlingEnabledEb
RZN14KJobUiDelegate6setJobEP4KJob
RZN14KJobUiDelegate7Private9_k_resultEv
RZN14KJobUiDelegateC1E6QFlagsINS_4FlagEE
RZN14KJobUiDelegateC1Ev
RZN14KJobUiDelegateC2E6QFlagsINS_4FlagEE
RZN14KJobUiDelegateC2Ev
RZN14KJobUiDelegateD0Ev
RZN14KJobUiDelegateD1Ev
RZN14KJobUiDelegateD2Ev
RZN14KMacroExpander12expandMacrosERK7QStringRK5QHashI5QChar11QStringListES4_
RZN14KMacroExpander12expandMacrosERK7QStringRK5QHashI5QCharS0_ES4_
RZN14KMacroExpander12expandMacrosERK7QStringRK5QHashIS0_11QStringListE5QChar
RZN14KMacroExpander12expandMacrosERK7QStringRK5QHashIS0_S0_E5QChar
RZN14KMacroExpander22expandMacrosShellQuoteERK7QStringRK5QHashI5QChar11QStringListES4_
RZN14KMacroExpander22expandMacrosShellQuoteERK7QStringRK5QHashI5QCharS0_ES4_
RZN14KMacroExpander22expandMacrosShellQuoteERK7QStringRK5QHashIS0_11QStringListE5QChar
RZN14KMacroExpander22expandMacrosShellQuoteERK7QStringRK5QHashIS0_S0_E5QChar
RZN14KPluginFactory11qt_metacallEN11QMetaObject4CallEiPPv
RZN14KPluginFactory11qt_metacastEPKc
RZN14KPluginFactory11setMetaDataERK15KPluginMetaData
RZN14KPluginFactory12createObjectEP7QObjectPKcRK11QStringList
RZN14KPluginFactory13objectCreatedEP7QObject
RZN14KPluginFactory14registerPluginERK7QStringPK11QMetaObjectPFP7QObjectP7QWidgetS7_RK15KPluginMetaDataRK5QListI8QVariantEE
RZN14KPluginFactory14registerPluginERK7QStringPK11QMetaObjectPFP7QObjectP7QWidgetS7_RK5QListI8QVariantEE
RZN14KPluginFactory16createPartObjectEP7QWidgetP7QObjectPKcRK11QStringList
RZN14KPluginFactory16staticMetaObjectE
RZN14KPluginFactory18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN14KPluginFactory23stringListToVariantListERK11QStringList
RZN14KPluginFactory23variantListToStringListERK5QListI8QVariantE
RZN14KPluginFactory6createEPKcP7QWidgetP7QObjectRK5QListI8QVariantERK7QString
RZN14KPluginFactoryC1ER21KPluginFactoryPrivate
RZN14KPluginFactoryC1Ev
RZN14KPluginFactoryC2ER21KPluginFactoryPrivate
RZN14KPluginFactoryC2Ev
RZN14KPluginFactoryD0Ev
RZN14KPluginFactoryD1Ev
RZN14KPluginFactoryD2Ev
RZN14KStringHandler13logicalLengthERK7QString
RZN14KStringHandler14preProcessWrapERK7QString
RZN14KStringHandler6isUtf8EPKc
RZN14KStringHandler7obscureERK7QString
RZN14KStringHandler7tagUrlsERK7QString
RZN14KStringHandler8capwordsERK11QStringList
RZN14KStringHandler8capwordsERK7QString
RZN14KStringHandler8csqueezeERK7QStringi
RZN14KStringHandler8from8BitEPKc
RZN14KStringHandler8lsqueezeERK7QStringi
RZN14KStringHandler8rsqueezeERK7QStringi
RZN14KStringHandler9perlSplitERK18QRegularExpressionRK7QStringi
RZN14KStringHandler9perlSplitERK5QCharRK7QStringi
RZN14KStringHandler9perlSplitERK7QRegExpRK7QStringi
RZN14KStringHandler9perlSplitERK7QStringS2_i
RZN14KUserOrGroupIdIPvEC1ERKS1_
RZN14KUserOrGroupIdIPvEC1ES0_
RZN14KUserOrGroupIdIPvEC1Ev
RZN14KUserOrGroupIdIPvEC2ERKS1_
RZN14KUserOrGroupIdIPvEC2ES0_
RZN14KUserOrGroupIdIPvEC2Ev
RZN14KUserOrGroupIdIPvED1Ev
RZN14KUserOrGroupIdIPvED2Ev
RZN14QThreadStorageIP16KDirWatchPrivateE10deleteDataEPv
RZN14QThreadStorageIbE10deleteDataEPv
RZN15KFileSystemType14fileSystemTypeERK7QString
RZN15KPluginMetaData14readStringListERK11QJsonObjectRK7QString
RZN15KPluginMetaData15fromDesktopFileERK7QStringRK11QStringList
RZN15KPluginMetaData16staticMetaObjectE
RZN15KPluginMetaData18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN15KPluginMetaData19loadFromDesktopFileERK7QStringRK11QStringList
RZN15KPluginMetaData19readTranslatedValueERK11QJsonObjectRK7QStringRK10QJsonValue
RZN15KPluginMetaData20readTranslatedStringERK11QJsonObjectRK7QStringS5_
RZN15KPluginMetaDataC1ERK11QJsonObjectRK7QString
RZN15KPluginMetaDataC1ERK11QJsonObjectRK7QStringS5_
RZN15KPluginMetaDataC1ERK13KPluginLoader
RZN15KPluginMetaDataC1ERK13QPluginLoader
RZN15KPluginMetaDataC1ERK7QString
RZN15KPluginMetaDataC1ERKS_
RZN15KPluginMetaDataC1Ev
RZN15KPluginMetaDataC2ERK11QJsonObjectRK7QString
RZN15KPluginMetaDataC2ERK11QJsonObjectRK7QStringS5_
RZN15KPluginMetaDataC2ERK13KPluginLoader
RZN15KPluginMetaDataC2ERK13QPluginLoader
RZN15KPluginMetaDataC2ERK7QString
RZN15KPluginMetaDataC2ERKS_
RZN15KPluginMetaDataC2Ev
RZN15KPluginMetaDataD1Ev
RZN15KPluginMetaDataD2Ev
RZN15KPluginMetaDataaSERKS_
RZN15KRandomSequence6getIntEj
RZN15KRandomSequence7Private4drawEv
RZN15KRandomSequence7getBoolEv
RZN15KRandomSequence7getLongEm
RZN15KRandomSequence7setSeedEi
RZN15KRandomSequence7setSeedEl
RZN15KRandomSequence8modulateEi
RZN15KRandomSequence9getDoubleEv
RZN15KRandomSequenceC1ERKS_
RZN15KRandomSequenceC1Ei
RZN15KRandomSequenceC1El
RZN15KRandomSequenceC2ERKS_
RZN15KRandomSequenceC2Ei
RZN15KRandomSequenceC2El
RZN15KRandomSequenceD0Ev
RZN15KRandomSequenceD1Ev
RZN15KRandomSequenceD2Ev
RZN15KRandomSequenceaSERKS_
RZN16KDirWatchPrivate10slotRescanEv
RZN16KDirWatchPrivate10statisticsEv
RZN16KDirWatchPrivate11isNoisyFileEPKc
RZN16KDirWatchPrivate11qt_metacallEN11QMetaObject4CallEiPPv
RZN16KDirWatchPrivate11qt_metacastEPKc
RZN16KDirWatchPrivate11removeEntryEP9KDirWatchPNS_5EntryES3_
RZN16KDirWatchPrivate11removeEntryEP9KDirWatchRK7QStringPNS_5EntryE
RZN16KDirWatchPrivate11removeWatchEPNS_5EntryE
RZN16KDirWatchPrivate11useQFSWatchEPNS_5EntryE
RZN16KDirWatchPrivate13removeEntriesEP9KDirWatch
RZN16KDirWatchPrivate13stopEntryScanEP9KDirWatchPNS_5EntryE
RZN16KDirWatchPrivate16famEventReceivedEv
RZN16KDirWatchPrivate16fswEventReceivedERK7QString
RZN16KDirWatchPrivate16restartEntryScanEP9KDirWatchPNS_5EntryEb
RZN16KDirWatchPrivate16staticMetaObjectE
RZN16KDirWatchPrivate17slotRemoveDelayedEv
RZN16KDirWatchPrivate18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN16KDirWatchPrivate20inotifyEventReceivedEv
RZN16KDirWatchPrivate3refEv
RZN16KDirWatchPrivate5Entry12removeClientEP9KDirWatch
RZN16KDirWatchPrivate5Entry15propagate_dirtyEv
RZN16KDirWatchPrivate5Entry9addClientEP9KDirWatch6QFlagsINS1_9WatchModeEE
RZN16KDirWatchPrivate5EntryD1Ev
RZN16KDirWatchPrivate5EntryD2Ev
RZN16KDirWatchPrivate5entryERK7QString
RZN16KDirWatchPrivate5unrefEv
RZN16KDirWatchPrivate7useFreqEPNS_5EntryEi
RZN16KDirWatchPrivate7useStatEPNS_5EntryE
RZN16KDirWatchPrivate8addEntryEP9KDirWatchRK7QStringPNS_5EntryEb6QFlagsINS0_9WatchModeEE
RZN16KDirWatchPrivate8addWatchEPNS_5EntryE
RZN16KDirWatchPrivate8stopScanEP9KDirWatch
RZN16KDirWatchPrivate9emitEventEPNS_5EntryEiRK7QString
RZN16KDirWatchPrivate9resetListEP9KDirWatchb
RZN16KDirWatchPrivate9scanEntryEPNS_5EntryE
RZN16KDirWatchPrivate9startScanEP9KDirWatchbb
RZN16KDirWatchPrivateC1Ev
RZN16KDirWatchPrivateC2Ev
RZN16KDirWatchPrivateD0Ev
RZN16KDirWatchPrivateD1Ev
RZN16KDirWatchPrivateD2Ev
RZN16KSharedDataCache11deleteCacheERK7QString
RZN16KSharedDataCache12setTimestampEj
RZN16KSharedDataCache17setEvictionPolicyENS_14EvictionPolicyE
RZN16KSharedDataCache5clearEv
RZN16KSharedDataCache6insertERK7QStringRK10QByteArray
RZN16KSharedDataCacheC1ERK7QStringjj
RZN16KSharedDataCacheC2ERK7QStringjj
RZN16KSharedDataCacheD1Ev
RZN16KSharedDataCacheD2Ev
RZN17DesktopFileParser11escapeValueERK10QByteArray
RZN17DesktopFileParser13convertToJsonERK10QByteArrayR22ServiceTypeDefinitionsRK7QStringR11QJsonObjectS9_i
RZN17DesktopFileParser15deserializeListERK7QStringc
RZN17DesktopFileParser7convertERK7QStringRK11QStringListR11QJsonObjectPS0_
RZN17KListOpenFilesJob11qt_metacallEN11QMetaObject4CallEiPPv
RZN17KListOpenFilesJob11qt_metacastEPKc
RZN17KListOpenFilesJob16staticMetaObjectE
RZN17KListOpenFilesJob18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN17KListOpenFilesJob5startEv
RZN17KListOpenFilesJobC1ERK7QString
RZN17KListOpenFilesJobC2ERK7QString
RZN17KListOpenFilesJobD0Ev
RZN17KListOpenFilesJobD1Ev
RZN17KListOpenFilesJobD2Ev
RZN17KMacroMapExpanderI5QChar11QStringListE16expandPlainMacroERK7QStringiRS1_
RZN17KMacroMapExpanderI5QChar11QStringListE18expandEscapedMacroERK7QStringiRS1_
RZN17KMacroMapExpanderI5QChar11QStringListED0Ev
RZN17KMacroMapExpanderI5QChar11QStringListED1Ev
RZN17KMacroMapExpanderI5QChar7QStringE16expandPlainMacroERKS1_iR11QStringList
RZN17KMacroMapExpanderI5QChar7QStringE18expandEscapedMacroERKS1_iR11QStringList
RZN17KMacroMapExpanderI5QChar7QStringED0Ev
RZN17KMacroMapExpanderI5QChar7QStringED1Ev
RZN17KMacroMapExpanderI7QString11QStringListE16expandPlainMacroERKS0_iRS1_
RZN17KMacroMapExpanderI7QString11QStringListE18expandEscapedMacroERKS0_iRS1_
RZN17KMacroMapExpanderI7QString11QStringListED0Ev
RZN17KMacroMapExpanderI7QString11QStringListED1Ev
RZN17KMacroMapExpanderI7QStringS0_E16expandPlainMacroERKS0_iR11QStringList
RZN17KMacroMapExpanderI7QStringS0_E18expandEscapedMacroERKS0_iR11QStringList
RZN17KMacroMapExpanderI7QStringS0_ED0Ev
RZN17KMacroMapExpanderI7QStringS0_ED1Ev
RZN17KTextToHTMLHelper14getPhoneNumberEv
RZN17KTextToHTMLHelper15getEmailAddressEv
RZN17KTextToHTMLHelper15highlightedTextEv
RZN17KTextToHTMLHelper6getUrlEPb
RZN17KTextToHTMLHelperC1ERK7QStringiii
RZN17KTextToHTMLHelperC2ERK7QStringiii
RZN17Kdelibs4MigrationC1Ev
RZN17Kdelibs4MigrationC2Ev
RZN17Kdelibs4MigrationD1Ev
RZN17Kdelibs4MigrationD2Ev
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI12KAboutPersonLb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI12KAboutPersonLb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI13KAboutLicenseLb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI13KAboutLicenseLb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI5QPairI7QStringS2_ELb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperI5QPairI7QStringS2_ELb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIN4KJob4UnitELb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIN4KJob4UnitELb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperINS_25QPairVariantInterfaceImplELb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperINS_25QPairVariantInterfaceImplELb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIP29KTextToHTMLEmoticonsInterfaceLb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIP29KTextToHTMLEmoticonsInterfaceLb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIP4KJobLb1EE8DestructEPv
RZN17QtMetaTypePrivate23QMetaTypeFunctionHelperIP4KJobLb1EE9ConstructEPvPKv
RZN17QtMetaTypePrivate25QPairVariantInterfaceImpl12getFirstImplI5QPairI7QStringS3_EEENS_11VariantDataEPKPKvij
RZN17QtMetaTypePrivate25QPairVariantInterfaceImpl13getSecondImplI5QPairI7QStringS3_EEENS_11VariantDataEPKPKvij
RZN18KCharMacroExpander16expandPlainMacroERK7QStringiR11QStringList
RZN18KCharMacroExpander18expandEscapedMacroERK7QStringiR11QStringList
RZN18KMacroExpanderBase12expandMacrosER7QString
RZN18KMacroExpanderBase13setEscapeCharE5QChar
RZN18KMacroExpanderBase16expandPlainMacroERK7QStringiR11QStringList
RZN18KMacroExpanderBase18expandEscapedMacroERK7QStringiR11QStringList
RZN18KMacroExpanderBase22expandMacrosShellQuoteER7QString
RZN18KMacroExpanderBase22expandMacrosShellQuoteER7QStringRi
RZN18KMacroExpanderBaseC1E5QChar
RZN18KMacroExpanderBaseC2E5QChar
RZN18KMacroExpanderBaseD0Ev
RZN18KMacroExpanderBaseD1Ev
RZN18KMacroExpanderBaseD2Ev
RZN18KWordMacroExpander16expandPlainMacroERK7QStringiR11QStringList
RZN18KWordMacroExpander18expandEscapedMacroERK7QStringiR11QStringList
RZN18QMetaTypeIdQObjectIP4KJobLi8EE14qt_metatype_idEv
RZN18QSharedDataPointerIN10KUserGroup7PrivateEED1Ev
RZN18QSharedDataPointerIN12KProcessList19KProcessInfoPrivateEE13detach_helperEv
RZN18QSharedDataPointerIN12KProcessList19KProcessInfoPrivateEED1Ev
RZN18QSharedDataPointerIN13KAboutLicense7PrivateEE13detach_helperEv
RZN18QSharedDataPointerIN13KAboutLicense7PrivateEED1Ev
RZN20KAutoSaveFilePrivate12tempFileNameEv
RZN20KCompositeJobPrivateC1Ev
RZN20KCompositeJobPrivateC2Ev
RZN20KCompositeJobPrivateD0Ev
RZN20KCompositeJobPrivateD1Ev
RZN20KCompositeJobPrivateD2Ev
RZN20KJobTrackerInterface11descriptionEP4KJobRK7QStringRK5QPairIS2_S2_ES8_
RZN20KJobTrackerInterface11infoMessageEP4KJobRK7QStringS4_
RZN20KJobTrackerInterface11qt_metacallEN11QMetaObject4CallEiPPv
RZN20KJobTrackerInterface11qt_metacastEPKc
RZN20KJobTrackerInterface11registerJobEP4KJob
RZN20KJobTrackerInterface11totalAmountEP4KJobNS0_4UnitEy
RZN20KJobTrackerInterface13unregisterJobEP4KJob
RZN20KJobTrackerInterface15processedAmountEP4KJobNS0_4UnitEy
RZN20KJobTrackerInterface16staticMetaObjectE
RZN20KJobTrackerInterface18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
RZN20KJobTrackerInterface5speedEP4KJobm
RZN20KJobTrackerInterface7percentEP4KJobm
RZN20KJobTrackerInterface7resumedEP4KJob
RZN20KJobTrackerInterface7warningEP4KJobRK7QStringS4_
RZN20KJobTrackerInterface8finishedEP4KJob
RZN20KJobTrackerInterface9suspendedEP4KJob
RZN20KJobTrackerInterfaceC1EP7QObject
RZN20KJobTrackerInterfaceC2EP7QObject
RZN20KJobTrackerInterfaceD0Ev
RZN20KJobTrackerInterfaceD1Ev
RZN20KJobTrackerInterfaceD2Ev
RZN22Kdelibs4ConfigMigrator10setUiFilesERK11QStringList
RZN22Kdelibs4ConfigMigrator14setConfigFilesERK11QStringList
RZN22Kdelibs4ConfigMigrator7migrateEv
RZN22Kdelibs4ConfigMigratorC1ERK7QString
RZN22Kdelibs4ConfigMigratorC2ERK7QString
RZN22Kdelibs4ConfigMigratorD1Ev
RZN22Kdelibs4ConfigMigratorD2Ev
RZN22ServiceTypeDefinitions7addFileERK7QString
RZN22ServiceTypeDefinitions9fromFilesERK11QStringList
RZN25KTextToHTMLEmoticonsDummy14parseEmoticonsERK7QStringbRK11QStringList
RZN25KTextToHTMLEmoticonsDummyD0Ev
RZN25KTextToHTMLEmoticonsDummyD1Ev
RZN28QExplicitlySharedDataPointerI17WindowsSIDWrapperED1Ev
RZN28QExplicitlySharedDataPointerI22KPluginMetaDataPrivateED1Ev
RZN28QExplicitlySharedDataPointerIN5KUser7PrivateEED1Ev
RZN4KJob10emitResultEv
RZN4KJob10setPercentEm
RZN4KJob11descriptionEPS_RK7QStringRK5QPairIS1_S1_ES7_
RZN4KJob11emitPercentEyy
RZN4KJob11infoMessageEPS_RK7QStringS3_
RZN4KJob11qt_metacallEN11QMetaObject4CallEiPPv
RZN4KJob11qt_metacastEPKc
RZN4KJob11totalAmountEPS_NS_4UnitEy
RZN4KJob12setErrorTextERK7QString
RZN4KJob13processedSizeEPS_y

Sections

.text
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e62ccf1e5c561da53ca2f798bfd5b608

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

netapi32

ole32

shell32

userenv

Exports

Exports

Sections

.text Size: 507KB - Virtual size: 506KB

.data Size: 512B - Virtual size: 348B

.rdata Size: 43KB - Virtual size: 43KB

.bss Size: - Virtual size: 3KB

.edata Size: 56KB - Virtual size: 56KB

.idata Size: 29KB - Virtual size: 29KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 108KB - Virtual size: 106KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 507KB - Virtual size: 506KB

.data
Size: 512B - Virtual size: 348B

.rdata
Size: 43KB - Virtual size: 43KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 56KB - Virtual size: 56KB

.idata
Size: 29KB - Virtual size: 29KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 108KB - Virtual size: 106KB

.reloc
Size: 25KB - Virtual size: 24KB